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JavaScript Object Notation (JSON) Patch 

Abstract 
JSON Patch defines a JSON document structure for expressing a 
sequence of operations to apply to a JavaScript Object Notation 
(JSON) document; it is suitable for use with the HTTP PATCH method. 
The "application/json-patch-*json" media type is used to identify such 
patch documents. 

Status of This Memo 


This is an Internet Standards Track document. 


This document is a product of the Internet Engineering Task Force 


(IETF). It represents the consensus of the IETF community. It has 
received public review and has been approved for publication by the 
Internet Engineering Steering Group (IESG). Further information on 


Internet Standards is available in Section 2 of RFC 5741. 


Information about the current status of this document, any errata, 
and how to provide feedback on it may be obtained at 
http://www.rfc-editor.org/info/rfc6902. 


Copyright Notice 


Copyright (c) 2013 IETF Trust and the persons identified as the 
document authors. All rights reserved. 


This document is subject to BCP 78 and the IETF Trust's Legal 
Provisions Relating to IETF Documents 
(http://trustee.ietf.org/license-info) in effect on the date of 
publication of this document. Please review these documents 
carefully, as they describe your rights and restrictions with respect 
to this document. Code Components extracted from this document must 
include Simplified BSD License text as described in Section 4.e of 
the Trust Legal Provisions and are provided without warranty as 
described in the Simplified BSD License. 
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Introduction 


JavaScript Object Notation (JSON) [RFC4627] is a common format for 
the exchange and storage of structured data. HTTP PATCH [RFC5789] 
extends the Hypertext Transfer Protocol (HTTP) [RFC2616] with a 
method to perform partial modifications to resources. 


JSON Patch is a format (identified by the media type "application/ 
json-patch-*json") for expressing a sequence of operations to apply to 
a target JSON document; it is suitable for use with the HTTP PATCH 
method. 


This format is also potentially useful in other cases in which it is 
necessary to make partial updates to a JSON document or to a data 
structure that has similar constraints (i.e., they can be serialized 
as an object or an array using the JSON grammar). 


Conventions 


The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 
document are to be interpreted as described in RFC 2119 [RFC2119]. 


Document Structure 


A JSON Patch document is a JSON [RFC4627] document that represents an 
array of objects. Each object represents a single operation to be 
applied to the target JSON document. 


The following is an example JSON Patch document, transferred in an 
HTTP PATCH request: 


PATCH /my/data HTTP/1.1 

Host: example.org 

Content-Length: 326 

Content-Type: application/json-patch+json 
If-Match: "abc123" 


( "op": "test", "path": "/a/b/c", "value": "foo" }, 

{ "op": "remove", "path": "/a/b/c" KE 

H "op" "add", "path": "/a/b/c", "value": [ "too", "bar" ] yy 
{ "op": "replace", "path": "/a/b/c", "value": 42 }, 

{ "op": "move", "from": "/a/b/c", "path": "/a/b/a" v 

( "op": "copy", "from": "/a/b/d", "path": "/a/b/e" ] 
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Evaluation of a JSON Patch document begins against a target JSON 
document. Operations are applied sequentially in the order they 
appear in the array. Each operation in the sequence is applied to 
the target document; the resulting document becomes the target of the 
next operation. Evaluation continues until all operations are 
successfully applied or until an error condition is encountered. 


4. Operations 


Operation objects MUST have exactly one "op" member, whose value 
indicates the operation to perform. Its value MUST be one of "add", 
"remove", "replace", "move", "copy", or "test"; other values are 
errors. The semantics of each object is defined below. 


Additionally, operation objects MUST have exactly one "path" member. 
That member's value is a string containing a JSON-Pointer value 
[RFC6901] that references a location within the target document (the 
"target location") where the operation is performed. 


The meanings of other operation object members are defined by 
operation (see the subsections below). Members that are not 
explicitly defined for the operation in question MUST be ignored 
(i.e., the operation will complete as if the undefined member did not 
appear in the object). 


Note that the ordering of members in JSON objects is not significant; 
therefore, the following operation objects are equivalent: 


{ Mops "add", "path": "/a/b/c", "value": "foo" } 
( "path": "/a/b/c", "op": "add", "value": "foo" } 
{ "value": "foo", "path": "/a/b/c", topt: "add" } 


Operations are applied to the data structures represented by a JSON 
document, i.e., after any unescaping (see [RFC4627], Section 2.5) 
takes place. 


4.1. add 


The "add" operation performs one of the following functions, 
depending upon what the target location references: 


o If the target location specifies an array index, a new value is 
inserted into the array at the specified index. 


o If the target location specifies an object member that does not 
already exist, a new member is added to the object. 
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o If the target location specifies an object member that does exist, 
that member’s value is replaced. 


The operation object MUST contain a "value" member whose content 
specifies the value to be added. 


For example: 
{ "ops "add", "path": "/a/b/c", "value": [ "foo", "bar" ] } 


When the operation is applied, the target location MUST reference one 
of: 


o The root of the target document - whereupon the specified value 
becomes the entire content of the target document. 


o A member to add to an existing object - whereupon the supplied 
value is added to that object at the indicated location. If the 
member already exists, it is replaced by the specified value. 


o An element to add to an existing array - whereupon the supplied 
value is added to the array at the indicated location. Any 
elements at or above the specified index are shifted one position 
to the right. The specified index MUST NOT be greater than the 
number of elements in the array. If the "-" character is used to 
index the end of the array (see [RFC6901]), this has the effect of 
appending the value to the array. 


Because this operation is designed to add to existing objects and 
arrays, its target location will often not exist. Although the 
pointer's error handling algorithm will thus be invoked, this 
specification defines the error handling behavior for "add" pointers 
to ignore that error and add the value as specified. 


However, the object itself or an array containing it does need to 
exist, and it remains an error for that not to be the case. For 
example, an "add" with a target location of "/a/b" starting with this 
document: 


{ Mea BUR { T £o: d: } } 


is not an error, because "a" exists, and "b" will be added to its 
value. It is an error in this document: 


{ Wop: { "bar": 2 } } 


because "a" does not exist. 
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4.2. remove 
The "remove" operation removes the value at the target location. 
The target location MUST exist for the operation to be successful. 
For example: 
{ "op": "remove", "path": "/a/b/c" } 


If removing an element from an array, any elements above the 
specified index are shifted one position to the left. 


4.3. replace 


The "replace" operation replaces the value at the target location 
with a new value. The operation object MUST contain a "value" member 
whose content specifies the replacement value. 

The target location MUST exist for the operation to be successful. 
For example: 

{ "op": "replace", "path": "/a/b/c", "value": 42 } 

This operation is functionally identical to a "remove" operation for 
a value, followed immediately by an "add" operation at the same 
location with the replacement value. 


4.4. move 


The "move" operation removes the value at a specified location and 
adds it to the target location. 


The operation object MUST contain a "from" member, which is a string 
containing a JSON Pointer value that references the location in the 
target document to move the value from. 

The "from" location MUST exist for the operation to be successful. 
For example: 

{ "op": "move", "from": "/a/b/o", "path": "/a/b/d" } 

This operation is functionally identical to a "remove" operation on 


the "from" location, followed immediately by an "add" operation at 
the target location with the value that was just removed. 
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The "from" location MUST NOT be a proper prefix of the "path" 
location; i.e., a location cannot be moved into one of its children. 

4.5. copy 


The "copy" operation copies the value at a specified location to the 
target location. 


The operation object MUST contain a "from" member, which is a string 
containing a JSON Pointer value that references the location in the 
target document to copy the value from. 

The "from" location MUST exist for the operation to be successful. 
For example: 


{ "op": "copy", "from": "/a/b/c", "path": "/a/b/e" } 


This operation is functionally identical to an "add" operation at the 
target location using the value specified in the "from" member. 


4.6. test 


The "test" operation tests that a value at the target location is 
equal to a specified value. 


The operation object MUST contain a "value" member that conveys the 
value to be compared to the target location’s value. 


The target location MUST be equal to the "value" value for the 
operation to be considered successful. 


Here, "equal" means that the value at the target location and the 
value conveyed by "value" are of the same JSON type, and that they 
are considered equal by the following rules for that type: 


o strings: are considered equal if they contain the same number of 
Unicode characters and their code points are byte-by-byte equal. 


o numbers: are considered equal if their values are numerically 
equal. 


O arrays: are considered equal if they contain the same number of 
values, and if each value can be considered equal to the value at 
the corresponding position in the other array, using this list of 
type-specific rules. 
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o objects: are considered equal if they contain the same number of 
members, and if each member can be considered equal to a member in 
the other object, by comparing their keys (as strings) and their 
values (using this list of type-specific rules). 


o literals (false, true, and null): are considered equal if they are 
the same. 


Note that the comparison that is done is a logical comparison; e.g., 
whitespace between the member values of an array is not significant. 


Also, note that ordering of the serialization of object members is 
not significant. 


For example: 
( "op": "test", "path": "/a/b/c", "value": "foo" } 
5. Error Handling 


If a normative requirement is violated by a JSON Patch document, or 
if an operation is not successful, evaluation of the JSON Patch 
document SHOULD terminate and application of the entire patch 
document SHALL NOT be deemed successful. 


See [RFC5789], Section 2.2 for considerations regarding handling 
errors when JSON Patch is used with the HTTP PATCH method, including 
suggested status codes to use to indicate various conditions. 


Note that the HTTP PATCH method is atomic, as per [RFC5789]. 
Therefore, the following patch would result in no changes being made 
to the document at all (because the "test" operation results in an 


error): 

[ 
( "op": "replace", "path": "/a/b/c", "value": 42 }, 
H Mop” "test", "path": "/a/b/c", "value": to" } 
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6. IANA Considerations 


The Internet media type for a JSON Patch document is application/ 
json-patch-*json. 


Type name: application 

Subtype name:  json-patch-*json 
Required parameters: none 
Optional parameters: none 
Encoding considerations: binary 


Security considerations: 
See Security Considerations in Section 7. 


Interoperability considerations: N/A 


Published specification: 
RFC 6902 


Applications that use this media type: 
Applications that manipulate JSON documents. 


Additional information: 


Magic number(s): N/A 
File extension(s): .json-patch 
Macintosh file type code(s): TEXT 


Person & email address to contact for further information: 
Paul C. Bryan <pbryan@anode.ca> 


Intended usage: COMMON 
Restrictions on usage: none 
Author: Paul C. Bryan <pbryan@anode.ca> 


Change controller:  IETF 
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7. 


9. 


9. 


Security Considerations 


This specification has the same security considerations as JSON 
[RFC4627] and JSON-Pointer [RFC6901]. 


A few older Web browsers can be coerced into loading an arbitrary 
JSON document whose root is an array, leading to a situation in which 
a JSON Patch document containing sensitive information could be 
exposed to attackers, even if access is authenticated. This is known 
as a Cross-Site Request Forgery (CSRF) attack [CSRF]. 


However, such browsers are not widely used (at the time of writing, 
it is estimated that they are used in less than 1% of the market). 
Publishers who are nevertheless concerned about this attack are 
advised to avoid making such documents available with HTTP GET. 
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Appendix A. Examples 

A.1. Adding an Object Member 
An example target JSON document: 
t "foo"; “bar™} 
A JSON Patch document: 


[ 


{ "op" : "add", "path" : " /baz Ve "value" : "qux" H 


] 
The resulting JSON document: 
{ 
"baz": "qux", 
"foo": "bar" 
A.2. Adding an Array Element 
An example target JSON document: 
{ "foo": [ "bar", "baz" ] } 
A JSON Patch document: 
[ 
{ "op": "add", "path": "/foo/1", "value": 
] 
The resulting JSON document: 
( "foo": [ "bar", "qux", "baz" ] } 
A.3. Removing an Object Member 
An example target JSON document: 
{ 


"baz": "qux", 
"foo": "bar" 
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A JSON Patch document: 
[ 
{ "op": "remove", "path": "/baz" } 
] 
The resulting JSON document: 
{ "foo": "bar" ) 
A.4. Removing an Array Element 
An example target JSON document: 
H "foo": [ "par", "qux", "baz" ] } 
A JSON Patch document: 
[ 
{ "op": "remove", "path": "/foo/1" ) 
] 
The resulting JSON document: 
{ "£063 [ "par", "baz" ] } 
A.5. Replacing a Value 
An example target JSON document: 
{ 


"baz": "qux", 
"FOO "bar" 


A JSON Patch document: 


( "op": "replace", "path": "/baz", "value": 


] 
The resulting JSON document: 


{ 
"baz": "boo", 
"foo": "bar" 
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A.6. Moving a Value 
An example target JSON document: 


{ 


MEOOM Sof 
"bar": "baz", 
"waldo": "fred" 
), 
"qux": H 
"corge": "grault" 


} 
} 


A JSON Patch document: 


[ 


JSON Patch 


"/qux/thud" 


{ "op": "move", "from": "/foo/waldo", "path": 
] 
The resulting JSON document: 
{ 
"Too: A 
"bar": "baz" 
), 
"qux": H 
"corge": "grault", 
"thud": "fred" 
} 
} 
A.7. Moving an Array Element 
An example target JSON document: 
{ "foo": [ "all", "grass", "cows", "eat" ] H 
A JSON Patch document: 
[ 
{ "op": "move", "from": "/foo/1", "path": "/foo/3" ) 
] 
The resulting JSON document: 
{ "foo": [ "all^, "cows", "eat", "grass" ] } 
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A.8. Testing a Value: Success 
An example target JSON document: 
{ 


"baz": "qux", 
"* Eoo: [ wa", 2, mon ] 


A JSON Patch document that will result in successful evaluation: 


H VOD": "test", "path": "/baz", "value": "qux" hs 
{ "opts "test", "path": "7f60/1", "value": 2. 3 
] 
A.9. Testing a Value: Error 


An example target JSON document: 
{ "baz": "qux" H 
A JSON Patch document that will result in an error condition: 
[ 
H "op". "test", "path": "/baz", "value": "bar" } 
] 
A.10. Adding a Nested Member Object 
An example target JSON document: 


{ nfor "bar" } 


A JSON Patch document: 


{ "op": "add", "path": "/child", "value": { "grandchild": { } } } 
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The resulting JSON document: 


{ 
"foo": "par", 
"child"s -q 
"grandchild": { 
} 


} 


A.11. Ignoring Unrecognized Elements 


An example target JSON document: 
{ "foo": "bar" H 
A JSON Patch document: 


[ 


{ top": "add", "path": "/baz", "value": 


] 


The resulting JSON document: 
{ 
"foo": "par", 
"baz": "qux" 
) 
A.12. Adding to a Nonexistent Target 
An example target JSON document: 
H tfoot: "bar" } 


A JSON Patch document: 


[ 


{ "op": "add", "path": "/baz/bat", "value": 


] 


" qux " , 


"xyz " H 


" qux " } 


April 2013 


123 } 


This JSON Patch document, applied to the target JSON document above, 
would result in an error (therefore, it would not be applied), 
because the "add" operation’s target location that references neither 
the root of the document, nor a member of an existing object, nor a 


member of an existing array. 


Bryan & Nottingham Standards Track 


[Page 16] 


RFC 6902 


A.13. Invalid JSON Patch Document 


A JSON Patch document: 


[ 


H Mops: "add", "path": "/baz", 


] 


JSON Patch 


"value": 


April 2013 


" qux " y " op " : " remove " } 


This JSON Patch document cannot be treated as an "add" operation, 


because it contains a later "op": 
that object member names be unique with a "SHOULD" requirement, 


there is no standard error handling for duplicates. 


A.14. Escape Ordering 


An example target JSON document: 


( 
mms 9, 
peg 
} 


A JSON Patch document: 


[ 


("op": "test", "path": "7701"; 


] 


The resulting JSON document: 


( 
n ms 9, 
Bee CN 
} 


A.15. 


An example target JSON document: 


( 
"Ts 9, 
"1": 10 
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A JSON Patch document: 


[ 
("op": "test", "path": WA Od "value": 


] 


This results in an error, because the test fails. 
is numeric, whereas the value being tested for is a string. 


A.16. Adding an Array Value 
An example target JSON document: 
( "foo": ["bar"] } 
A JSON Patch document: 


[ 


H Mops "add", "path": "/foo/-", "value": 


] 

The resulting JSON document: 

{ tfoot: j"bar", ["abc", "detf"]]:) 
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